{"id":"CVE-2026-98702","kind":"vulnerability","aliases":["CVE-2026-98702"],"related":[],"title":"Linux kernel: forged Wi-Fi channel switch frame can panic the system","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reject invalid 320 MHz CSA bandwidth\n\nThe HT/VHT channel definition validator can receive a 320 MHz\nbandwidth indication from a received CSA frame on a non-6 GHz link.\nIt warns for this unsupported width but continues with an uninitialized\nvht_operation.chan_width, which is then read by\nieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a\nreceived frame panic the kernel.\n\nReject the channel definition before entering the VHT operation\nconversion. This preserves the existing CSA fallback while avoiding\nboth the warning and the uninitialized read.","summary":"A malformed 320 MHz channel switch announcement in a received Wi-Fi frame, on a link that does not support that width, leaves a value uninitialized in the mac80211 wireless stack. With panic_on_warn enabled, a nearby device sending that frame can crash the kernel.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","laptops","linux","mac80211","servers","wifi"],"not_affected_if":["no-wifi-hardware","panic-on-warn-disabled"],"how_to_check":"- Run `uname -r` and compare with the fixed kernel versions in the upstream commit, which the sources do not list.\n- Check whether `panic_on_warn` is set: `sysctl kernel.panic_on_warn` (unknown whether default configs enable it).\n- Check whether the machine uses a mac80211 Wi-Fi driver: `lsmod | grep mac80211`.","fix":"- Update the Linux kernel to a release that includes the mac80211 fix (version unknown from the sources).\n- Until then, keep `kernel.panic_on_warn` at `0` if the machine does not need it.","status":"open","published_at":"2026-10-18T16:17:23+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:18:53+00:00","updated_at":"2026-10-25T05:18:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:18:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the mac80211 fix (version unknown from the sources).\n- Until then, keep `kernel.panic_on_warn` at `0` if the machine does not need it.","reach":"network","title":"Linux kernel: forged Wi-Fi channel switch frame can panic the system","impact":"low","summary":"A malformed 320 MHz channel switch announcement in a received Wi-Fi frame, on a link that does not support that width, leaves a value uninitialized in the mac80211 wireless stack. With panic_on_warn enabled, a nearby device sending that frame can crash the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","wifi","mac80211","servers","laptops"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel panic and denial of service from one received Wi-Fi frame","analyst_note":"Find the upstream kernel commit and the first fixed stable release versions on kernel.org or NVD; the sources give no CVSS score or fixed version.","how_to_check":"- Run `uname -r` and compare with the fixed kernel versions in the upstream commit, which the sources do not list.\n- Check whether `panic_on_warn` is set: `sysctl kernel.panic_on_warn` (unknown whether default configs enable it).\n- Check whether the machine uses a mac80211 Wi-Fi driver: `lsmod | grep mac80211`.","needs_analyst":true,"not_affected_if":["no-wifi-hardware","panic-on-warn-disabled"],"who_is_affected":"Machines running a Linux kernel with mac80211 Wi-Fi support, reachable by radio from an attacker in range. Systems that do not use Wi-Fi through mac80211, or that keep panic_on_warn disabled, are unlikely to crash from this frame; the sources do not say whether a non-panic path has other effects.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":3458,"output_tokens":701,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-6':112C '-98702':16A,19A '320':29B,88C,100C 'announc':33B 'avoid':167C 'bandwidth':91C,102C 'chandef':134C 'channel':7A,31B,94C,152C 'continu':122C 'convers':159C 'crash':71B 'csa':90C,107C,164C 'cve':14A,17A 'definit':95C,153C 'devic':66B 'enabl':63B,141C 'enter':155C 'exist':163C 'fallback':165C 'fi':6A,39B 'follow':79C 'forg':3A 'frame':9A,40B,69B,108C,146C 'ghz':113C 'ht/vht':93C 'ieee80211':133C 'indic':103C 'infrastructur':20B 'invalid':87C 'kernel':2A,21B,73B,77C,149C 'laptop':22B 'leav':50B 'let':143C 'link':43B,114C 'linux':1A,23B,76C 'mac80211':24B,56B,85C 'malform':28B 'mhz':30B,89C,101C 'nearbi':65B 'non':111C 'oper':136C,158C 'panic':11A,60B,138C,147C 'preserv':161C 'read':131C,174C 'receiv':36B,98C,106C,145C 'reject':86C,150C 'resolv':83C 'send':67B 'server':25B 'stack':58B 'support':47B 'switch':8A,32B 'system':13A 'uniniti':53B,125C,173C 'unsupport':119C 'valid':96C 'valu':52B 'vht':135C,157C 'vht_operation.chan':126C 'vulner':80C 'warn':62B,116C,140C,170C 'wi':5A,38B 'wi-fi':4A,37B 'width':49B,120C,127C 'wifi':26B,84C 'wireless':57B","nicknames":[],"mitigations":[],"who_affected":"Machines running a Linux kernel with mac80211 Wi-Fi support, reachable by radio from an attacker in range. Systems that do not use Wi-Fi through mac80211, or that keep panic_on_warn disabled, are unlikely to crash from this frame; the sources do not say whether a non-panic path has other effects.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98702","severity":null,"published_at":"2026-10-18T16:17:23+00:00","modified_at":"2026-10-19T10:19:34+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}